Risk analysis for global retail company

Risk analysis

The company has offices in over 20 countries, and currently employs approximately 700 independent suppliers. The company has more than 2,000 stores, with a turnover of over 50 billion.

The challenge

The company has a large geographical spread, a large number of ongoing development projects and many administration systems. Managing security risks presents, therefore, major challenges. The company needs a solution that provides an effective way of managing its security risks in projects, new developments and changes.

We were commissioned to find a process to initiate risk activities at the correct phase and to identify and evaluate security-related risks. This had to be managed continuously in the company's existing processes. The company lacked a defined risk methodology and dedicated resources for methodical support of the risk process, and to facilitate the implementation of risk activities.

Our solution

Together with the company, We began to create a simple and pragmatic method for ordering and carrying out continuous risk assessments in projects and administration. The risk model and method were created according to ISO 27005, and the criteria were based on the company's pre-conditions. A risk analysis report was presented, containing; identified risks, assessed risks and recommended measures for every occasion. We also provided qualified resources for facilitation and methodical support of ordered risk analyses.

Customer benefit

The risk model and methodology created the prerequisites for a gradual dissemination of knowledge regarding risk management throughout the company and increased security awareness. This enabled the company to manage risk analyzes itself, using well-implemented processes and proven risk analysis methods.

The risk assessment reports formed the basis for better decision making, with prioritized measures for the project or management organization. This increased control and secured critical information assets for the company's operations.

This case was conducted by Safeside Solutions AB, now part of Nixu Corporation.

Related blogs

Let’s build on trust!

In today’s society, trust is immensely precious to everyone, not only to consumers but also to companies and organizations whose business relies on digitalization. How we build and maintain that trust is a very topical issue in which cybersecurity has a key role to play. October is the official European Cyber Security Month and it is being celebrated for the fifth time this year with the important goal of highlighting the importance of cybersecurity in society.

by Veera Relander
October 9, 2017 at 10:30

Things that security auditors will nag about, Part 1: #NoLogs

This the first part of our blog series "Things that security auditors will nag about and why you shouldn't ignore them". In these articles, Nixu's security consultants explain issues that often come up when assessing the security of web applications, platforms and other computer systems.

September 4, 2017 at 10:01

Why certify and what is ISO 27001?

ISO 27001 has become the de facto standard for Information Security Management System certifications. Most other security standards are based on or refer to ISO 27001 at least to some degree. We also see a trend that regulators are keen to use ISO 27001 as a baseline for security instead of inventing yet another new standard for industry actors to follow.

by Niki Klaus
May 30, 2017 at 10:30